Lucene search

[email protected]CVE-2020-3934

HistoryFeb 11, 2020 - 12:15 p.m.

CVE-2020-3934

2020-02-1112:15:21

CWE-89

[email protected]

web.nvd.nist.gov

cve-2020-3934

taiwan secom

door access control

personnel attendance management

sql injection

security vulnerability

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.3%

JSON

TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection, allowing attackers to inject a specific SQL command.

Affected configurations

NVD

Node

secomdr.id_access_controlRange<3.3.2

secomdr.id_attendance_systemRange<3.3.0.3_20160517

CPENameOperatorVersion
secom:dr.id_access_controlsecom dr.id access controllt3.3.2
secom:dr.id_attendance_systemsecom dr.id attendance systemlt3.3.0.3_20160517

CPE	Name	Operator	Version
secom:dr.id_access_control	secom dr.id access control	lt	3.3.2
secom:dr.id_attendance_system	secom dr.id attendance system	lt	3.3.0.3_20160517

CNA Affected

[
  {
    "product": "Door Access Control system",
    "vendor": "TAIWAN SECOM CO., LTD.",
    "versions": [
      {
        "lessThanOrEqual": "3.3.2",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Personnel Attendance system",
    "vendor": "TAIWAN SECOM CO., LTD.",
    "versions": [
      {
        "lessThanOrEqual": "3.3.0.3_20160517",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

gist.github.com/chtsecurity/4db471b34c3959e5ab9ec31570e4760b

www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bac

www.twcert.org.tw/en/cp-139-3318-89f76-2.html

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.3%

JSON

Related for CVE-2020-3934

nvd1 cvelist1 prion1